Information processing device, information processing method and non-transitory computer-readable storage medium

ABSTRACT

An information processing device including a processor configured to execute a process including when a first packet is captured, extracting, from the first packet, first element data corresponding to a session, storing the extracted first element data in association with the first packet and the session, when second element data associated with a second packet and the session is stored, coupling the extracted first element data to the second element data, obtaining, for each of the first packet and the second packet, a data value from a predetermined position in a packet, and when a data size of a specific element data that is one of the first element data and the second element data matches the obtained data value corresponding to the packet associated with the specific element data, discarding element data, associated with the session, other than the specific element data.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of priority of theprior Japanese Patent Application No. 2017-219158, filed on Nov. 14,2017, the entire contents of which are incorporated herein by reference.

FIELD

The embodiments discussed herein are related to an informationprocessing device, an information processing method, and anon-transitory computer-readable storage medium.

BACKGROUND

An analyzer that analyzes a message transmitted between computersacquires a packet passing through a switch connected to the computer bymirroring or the like, and stores the acquired packet in a storage unitsuch as a packet buffer. In a case where the size of the messagetransmitted between the computers is larger than the size that may beaccommodated in one packet as a unit of transmission, the message isdivided into a plurality of parts, stored in each of a plurality ofpackets, and transmitted as a group of packets. The analyzer couples thedivided message parts included in the packet group, whereby assemblesthe divided message parts into the original message, and analyzes theassembled original message (For example, see Japanese Laid-open PatentPublication No. 2014-042290).

For example, a device that transmits packets sets the transmissioninterval of the packets between different messages to be longer than thetransmission interval of the packets within one and the same message.Utilizing this property, the packet analyzer determines that a packetwhose reception interval is equal to or greater than a predeterminedthreshold value is a head packet of the packet group including thedivided message to perform a message reception process (For example, seeJapanese Laid-open Patent Publication No. 2011-182211).

SUMMARY

According to an aspect of the embodiments, an information processingdevice including a memory, and a processor coupled to the memory and theprocessor configured to execute a process, the process including, when afirst packet transmitted from a communication device to anothercommunication device via a network is captured, extracting, from thefirst packet, first element data corresponding to a session used forcommunication of the first packet, storing, in a storage device, theextracted first element data in association with the first packet andthe session, when second element data associated with a second packetand the session is stored in the storage unit, coupling the extractedfirst element data to the second element data, obtaining, for each ofthe first packet and the second packet, a data value from apredetermined position in a packet, the predetermined position being aposition at which a fragment length is stored in a case where the packetis a head packet, and when a data size of a specific element data thatis one of the first element data and the second element data, for whichthe coupling has been executed, matches the obtained data valuecorresponding to the packet associated with the specific element data,discarding element data, associated with the session, other than thespecific element data from the storage device.

The object and advantages of the invention will be realized and attainedby means of the elements and combinations particularly pointed out inthe claims.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and arenot restrictive of the invention.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram illustrating an embodiment of an informationprocessing device, an information processing method, and a program;

FIG. 2 is a diagram illustrating an example of an operation of theinformation processing device illustrated in FIG. 1;

FIG. 3 is a diagram illustrating another embodiment of an informationprocessing device, an information processing method, and a program;

FIG. 4 is a diagram illustrating an example of a structure of a packetcaptured by a capture node illustrated in FIG. 3;

FIG. 5 is a diagram illustrating an example of the structure of an RMand an RPC headers illustrated in FIG. 4;

FIG. 6 illustrates an example of a plurality of packets transmitted viaa network switch illustrated in FIG. 3, and an example in a case where acapture node illustrated in FIG. 3 captures the packets with the headpacket lost;

FIGS. 7A and 7B are diagrams illustrating an example of an operation ofan analysis node illustrated in FIG. 3;

FIGS. 8A and 8B are diagrams illustrating a subsequent operation of theanalysis node in FIGS. 7A and 7B;

FIG. 9 is a diagram illustrating an example of an operation flow of theanalysis node illustrated in FIG. 3;

FIG. 10 is a diagram illustrating another embodiment of an informationprocessing device, an information processing method, and a program;

FIGS. 11A and 11B are diagrams illustrating an example of an operationof an analysis node illustrated in FIG. 10;

FIGS. 12A and 12B are diagrams illustrating a subsequent operation ofthe analysis node in FIGS. 11A and 11B;

FIG. 13 is a diagram illustrating an example of an operation flow of ananalysis node illustrated in FIG. 10;

FIG. 14 is a diagram illustrating an example of an operation flow ofstep S200 illustrated in FIG. 13; and

FIG. 15 is a diagram illustrating an example of a hardware configurationof the information processing device illustrated in FIG. 1 and theanalysis nodes illustrated in FIGS. 3 and 10.

DESCRIPTION OF EMBODIMENTS

Recently, the transmission rate of packets transmitted on a transmissionpath such as a network tends to increase, and the difference between thetransmission interval of the packets between different messages and thetransmission interval of the packets within one and the same message hasdecrease. Therefore, in a method of determining a head packet based onthe packet reception interval, a packet other than the head packet maybe erroneously determined as a head packet. In a case where thedetermination of the head packet is wrong, an enormous amount oferroneous messages may be acquired.

In one aspect, the techniques disclosed in the embodiments intend toleave packets containing a message in a storage unit while discardingfrom the storage unit packets not including a message to be acquired.

Hereinafter, embodiments will be described with reference to thedrawings.

FIG. 1 is a diagram illustrating an embodiment of an informationprocessing device, an information processing method, and a program. Aninformation processing system 100 illustrated in FIG. 1 includes acapture device 2 and an information processing device 3. The capturedevice 2 has a function of capturing, via a network NW such as theInternet or an intranet, packets A (A1, A2, A3, A4, A5) and B (B1, B2,B3) transmitted between the communication devices 1 (1 a, 1 b, 1 c). Forexample, the capture device 2 captures a packet transmitted to atransmission path TP connecting the communication device 1 c to thenetwork NW.

For example, the communication devices 1 a, 1 b and 1 c transmit apacket using transmission control protocol/internet protocol (TCP/IP),which is a standard protocol of the Internet. Communication between thecommunication devices 1 a and 1 c is also referred to as a sessionSSN-A, and communication between the communication devices 1 b and 1 cis also referred to as a session SSN-B.

In the example illustrated in FIG. 1, the communication device 1 atransmits the packets A1 to A5 to the communication device 1 c, and thecommunication device 1 b transmits the packets B1 to B3 to thecommunication device 1 c. For the communication device 1 a, since thesize of the message to be transmitted to the communication device 1 c ismore than twice and 3 times or less the size that may be accommodated inone packet, the message is divided into three packets A1 to A3 andtransmitted. For the communication device 1 a, since the size of thenext message to be transmitted to the communication device 1 c is morethan the size and 2 times or less the size that may be accommodated inone packet, the message is divided into two packets A4 to A5 andtransmitted.

Similarly, for the communication device 1 b, since the size of themessage to be transmitted to the communication device 1 c is more thantwice and 3 times or less the size that may be accommodated in onepacket, the message is divided into three packets B1 to B3 andtransmitted. Each of the packets A1, A4, and B1 indicated by the boldframe indicates a head packet among a plurality of packets used fortransmission of each message.

For example, a head packet includes a fragment region storing a fragmentlength which is a size before division of a message at the head of adata payload region where data is stored. Packets other than the headpacket have no fragment region. For packets other than the head packet,the value stored at the position corresponding to the fragment region isnot the fragment length, but data included in the message.

In the example illustrated in FIG. 1, the capture device 2 misses thecapture of the packet A1 due to the capture operation start timing erroror the capture operation error or the like. The capture device 2sequentially captures the packets A2, B1, A3, B2, A4, A5, and B3 otherthan the packet A1, and the captured packets are stored in a storagedevice (not illustrated). The capture device 2 outputs the capturedpackets A2, B1, A3, B2, A4, A5, and B3 to the information processingdevice 3.

The capture device 2 may output, based on a packet acquisition requestfrom the information processing device 3, a packet satisfying theacquisition condition included in the packet acquisition request to theinformation processing device 3. For example, the capture device 2outputs the packets A2, B1, A3, B2, A4, A5, and B3 satisfying theacquisition condition to the information processing device 3 in a casewhere the acquisition condition included in the packet acquisitionrequest received from the information processing device 3 is “the packetreceived by the communication device 1 c”.

The information processing device 3 includes a packet collection unit 4,a message extraction unit 5, and a storage unit 6. The storage unit 6has a list region 7 in which a list to be described later is stored, anda program region 8 in which a program is stored. The storage unit 6 maybe arranged outside the information processing device 3. For example,the functions of the packet collection unit 4 and the message extractionunit 5 are implemented by the information processing device 3 performingthe program stored in the program region 8. The functions of the packetcollection unit 4 and the message extraction unit 5 may be implementedby hardware such as field-programmable gate array (FPGA) owned by theinformation processing device 3.

The packet collection unit 4 performs the following processing on theassumption that each of the packets A2 to A5, and B1 to B3 is the headpacket. The packet collection unit 4 stores an element included in eachof the packets A2 to A5 corresponding to the session SSN-A in the listregion 7 in the order of reception. The packet collection unit 4 storesan element included in each of the packets B1 to B3 corresponding to thesession SSN-B in the list region 7 in the order of reception. Forexample, the element included in each of the packets A2 to A5 issequentially stored in the list region 7 in association with the sessionSSN-A, and the element included in each of the packets B1 to B3 aresequentially stored in the list region 7 in association with the sessionSSN-B. In the following, an element included in a packet is given thesame reference numerals as those of packets containing the element.

In a case where the element of the packet A corresponding to the sessionSSN-A has been already stored in the list region 7, the packetcollection unit 4 couples the data included in the new packet A to thedata included in the element already stored in the list region 7.Similarly, in a case where the element of the packet B corresponding tothe session SSN-B has been already stored in the list region 7, thepacket collection unit 4 couples the data in the new packet B to thedata included in the element already stored in the list region 7. Anexample of the operation of the packet collection unit 4 is described inFIG. 2.

The message extraction unit 5 performs the following processing on theassumption that each of the packets A2 to A5 and B1 to B3 is the headpacket. In each of the elements of the packets A2 to A5 stored in thelist region 7 in association with the session SSN-A, the messageextraction unit 5 assumes the value stored at the position correspondingto the fragment region of the head packet as the fragment length. In acase where there is an element in which the size of the coupled datamatches the assumed fragment length, the message extraction unit 5determines that the data included in the matched element is a message.

The message extraction unit 5 discards elements other than the matchedelements from the list region 7. An example of the operation of themessage extraction unit 5 will be described with reference to FIG. 2. Ina case where a message may be accommodated in one packet, the message istransmitted using only the head packet. In this case, since the size ofthe data included in the packet matches the fragment length, the messageextraction unit 5 determines that the data included in the elementstored in the list region 7 in accordance with a single packet is amessage.

FIG. 2 illustrates an example of the operation of the informationprocessing device 3 illustrated in FIG. 1. FIG. 2 illustrates how thelists LIST-A and LIST-B stored in the list region 7 illustrated in FIG.1 change. The packet collection unit 4 illustrated in FIG. 1 creates thelist LIST-A using the packets A received from the capture device 2 inaccordance with the session SSN-A. The packet collection unit 4 createsthe list LIST-B using the packets B received from the capture device 2in accordance with the session SSN-B. In the following, in the listregion 7, a region in which an element included in each packet is storedis referred to as an element region, and each element region is giventhe same reference numeral as that of the corresponding packet.

As described in FIG. 1, the packet collection unit 4 and the messageextraction unit 5 treat each of the packets A and B received from thecapture device 2 as a head packet. The elements included in the elementregions A (A1 to A5) of the list LIST-A include the fragment lengths FLA(FLA1 to FLA5) and the data AD (AD1 to AD5). The elements included inthe element regions B (B1 to B3) of the list LIST-B include the fragmentlengths FLB (FLB1 to FLB3) and data BD (BD1 to BD3). The fragmentlengths FLB1 and FLA4 indicated by the bold frames are the correctfragment lengths included in the head packet. Fragment lengths FLA2,FLA3, FLA5, and FLB2, and FLB3 indicated by the non-bold frame are falsefragment lengths which are not correct fragment lengths (nonsensevalue). This is because, in a packet other than the head packet, thedata stored at the position corresponding to the position where thefragment length is stored in the head packet is referred to as a falsefragment length.

First, the packet collection unit 4 stores the false fragment lengthFLA2 included in the packet A2 and the data AD2 included in the packetA2 in the element region A2 of the list LIST-A ((a) in FIG. 2). Themessage extraction unit 5 determines that the packet A2 is not the headpacket since the sizes of the fragment length FLA2 and the data AD2 donot match in the element region A2, and determines that the data AD2 isnot a message.

The packet collection unit 4 stores the correct fragment length FLB1included in the packet B1 and the data BD1 included in the packet B1 inthe element region B1 of the list LIST-B ((b) in FIG. 2). The messageextraction unit 5 determines that the packet B1 is not the head packetat this time since the sizes of the fragment length FLB1 and the dataBD1 do not match in the element region B1, and determines that the dataBD1 is not a message.

Next, the packet collection unit 4 stores the false fragment length FLA3included in the packet A3 and the data AD3 included in the packet A3 inthe element region A3 of the list LIST-A ((c) in FIG. 2). Since theelement is already included in the element region A2 corresponding tothe session SSN-A, the packet collection unit 4 couples the data AD3included in the packet A3 to the data AD2 included in the element regionA2 ((d) in FIG. 2). In the example illustrated in FIG. 2, the packetcollection unit 4 copies the data AD3 included in the element region A3to the element region A2, thereby coupling the data AD3 to the data AD2.Using a pointer indicating the position of the data, the data AD3 may becoupled to the data AD2. For the coupling of the other data, similarly,a pointer indicating the position of the data may be used.

The message extraction unit 5 determines that the packet A2 is not thehead packet since the sizes of the fragment length FLA2 and the sum ofthe sizes of the data AD2 and AD3 do not match in the element region A2,and determines that the data string by the data AD2 and AD3 is not amessage. The message extraction unit 5 determines that the packet A3 isnot the head packet since the sizes of the fragment length FLA3 and thedata AD3 do not match in the element region A3, and determines that thedata AD3 is not a message.

Nest, the packet collection unit 4 stores the false fragment length FLB2included in the packet B2 and the data BD2 included in the packet B2 inthe element region B2 of the list LIST-B ((e) in FIG. 2). Since theelement is already included in the element region B1 corresponding tothe session SSN-B, the packet collection unit 4 couples the data BD2included in the packet B2 to the data BD1 in the element region B1 ((f)in FIG. 2). The message extraction unit 5 determines that the packet B1is not the head packet at this time since the fragment length FLB1 andthe sum of the sizes of the data BD1 and BD2 do not match in the packetB1, and determines that the data string by the data BD1 and BD2 is not amessage. The message extraction unit 5 determines that the packet B2 isnot the head packet since the sizes of the fragment length FLB2 and thedata BD2 do not match, and determines that the data BD2 is not amessage.

Next, the packet collection unit 4 stores the correct fragment lengthFLA4 included in the packet A4 and the data AD4 included in the packetA4 in the element region A4 of the list LIST-A ((g) in FIG. 2). Sincethe elements are already included in the element regions A2 and A3corresponding to session SSN-A, the packet collection unit 4 couples thedata AD4 in the packet A4 to AD2 and AD3 in the element region A2, andcouples the data AD4 in the packet A4 to the data AD3 in the elementregion A3 ((h) in FIG. 2).

The message extraction unit 5 determines that the packet A2 is not thehead packet since the sizes of the fragment length FLA2 and the sum ofthe sizes of the data AD2 to AD4 do not match in the element region A2,and determines that the data string by the data AD2 to AD4 is not amessage. The message extraction unit 5 determines that the packet A3 isnot the head packet since the sizes of the fragment length FLA3 and thesum of the sizes of the data AD3 and AD4 do not match in the elementregion A3, and determines that the data string by the data AD3 and AD4is not a message. The message extraction unit 5 determines that thepacket A4 is not the head packet at this time since the sizes of thefragment length FLA4 and the data AD4 do not match in the element regionA4, and determines that the data AD4 is not a message.

Next, the packet collection unit 4 stores the false fragment length FLA5included in the packet A5 and the data AD5 included in the packet A5 inthe element region A5 of the list LIST-A ((i) in FIG. 2). Since theelements are already included in the element regions A2, A3, and A4corresponding to the session SSN-A, the packet collection unit 4 couplesthe data AD5 in the packet A5 to the data AD2 to AD4 in the elementregion A2. The packet collection unit 4 couples the data AD5 in thepacket A5 to the data AD3 and AD4 in the element region A3, and couplesthe data AD5 in the packet A5 to the data AD4 in the element region A4((j) in FIG. 2).

The message extraction unit 5 determines that the packet A2 is not thehead packet since the sizes of the fragment length FLA2 and the sum ofthe sizes of the data AD2 to AD5 do not match in the element region A2,and determines that the data string by the data AD2 to AD5 is not amessage. The message extraction unit 5 determines that the packet A3 isnot the head packet since the sizes of the fragment length FLA3 and thesum of the sizes of the data AD3 to AD5 do not match in the elementregion A3, and determines that the data string by the data AD3 to AD5 isnot a message.

Since the fragment length FLA4 and the sum of the sizes of the data AD4and AD5 match in the element region A4, the message extraction unit 5determines that the packet A4 is the head packet, and the data string bythe data AD4 and AD5 is the message MSG-A ((k) in FIG. 2). In a casewhere finding the head packet A4, the message extraction unit 5 discardthe elements included in the element regions A2, A3, and A5 other thanthe element region A4 corresponding to the head packet A4 ((l), (m) and(n) in FIG. 2).

The message extraction unit 5 extracts, based on the detection of thehead packet A4, extract the message MSG-A from the list LIST-A to outputthe extracted message to an analysis unit (not illustrated) of theinformation processing device 3. Thereafter, the message extraction unit5 discards from the list LIST-A the element included in the elementregion A4 including the message MSG-A. The analysis unit analyzes themessage MSG-A, and depending on the analysis result, finds the cause ofcommunication failure or the like occurring in the communication pathbetween the communication devices 1 a and 1 c.

Next, the packet collection unit 4 stores the false fragment length FLB3included in the packet B3, and the data BD3 included in the packet B3 inthe element region B3 of the list LIST-B ((o) in FIG. 2). Since theelements are already included in the element regions B1 and B2corresponding to the session SSN-B, the packet collection unit 4 couplesthe data BD3 in the packet B3 to the data BD1 and BD2 in the elementregion B1, and couples the data BD3 in the packet B3 to the data BD2 inthe element region B2 ((p) in FIG. 2).

The message extraction unit 5 determines that the data string by thedata BD1 to BD3 is the message MSG-B since fragment length FLB1 and thesum of the sizes of the data BD1 to BD3 match in the element region B1((q) in FIG. 2). In a case where finding the message MSG-B from the listLIST-B, the message extraction unit 5 discards the elements included inthe element regions B2 and B3 other than the element region B1corresponding to the message MSG-B ((r) and (s) in FIG. 2).

Based on the detection of the head packet B1, the message extractionunit 5 extracts the message MSG-B from the list LIST-B, and afteroutputting the extracted message to the analysis unit (not illustrated),discards from the list LIST-B the element included in the element regionB1 including the message MSG-B. The analysis unit analyzes the messageMSG-B, and depending on the analysis result, finds the cause ofcommunication failure or the like occurring in the communication pathbetween the communication devices 1 b and 1 c.

In this way, in a case where the head packet is unknown and the processof finding the head packet by using the element region corresponding toeach packet is performed, it is possible to leave only the elementregion corresponding to the head packet, and discard the elementsincluded in the other element regions. Since the data including themessage is stored in the element region corresponding to the headpacket, it is possible to extract a message using the element regionleft in the list region 7.

The packet collection unit 4 copies the data AD5 included in the elementregion A5 to the element region A4, thereby coupling the data AD4 andAD5. As a result, the message extraction unit 5 may extract the messageMSG-A from the list region 7 when the fragment length FLA4 matches thesum of the sizes of the data AD4 and AD5. For example, it is possible toquickly start the analysis processing of the message MSG-A, comparedwith the case where the message MSG-A is assembled after the fragmentlength FLA4 matches the sum of the sizes of the data AD4 and AD5.

The information processing device 3 performs a process of coupling thedata on the assumption that all packets A2 to A5 are head packets, sothat it is possible to acquire the message MSG-A even when the firstreceived packet A2 is not the head packet. Since the message extractionunit 5 performs the detection operation of the head packet A4 inparallel with the operation of coupling the data, the message MSG-A maybe acquired in a case where the head packet A4 is detected.

In a case where message acquisition processing is performed with packetA2 first received from capture device 2 as a head packet, the valuestored at the position corresponding to the fragment region of the headpacket is set to the fragment length (false) in the packet A2. Forexample, in a case where the false fragment length is the maximum valuethat may be set, the data included in each of packets A3, A4, A5 . . .following the packet A2 are coupled in an endless manner. As a result,neither the message MSG-A that has the packet A4 as the head packet norother messages included in the packet received after the packet A5 maynot be acquired, and it is not possible to analyze the message.

As described above, in the embodiment illustrated in FIGS. 1 and 2, thefollowing effects may be obtained. In a case where the head packet isunknown and the process of finding the head packet by using the elementregion corresponding to each packet is performed, it is possible toleave only the element region corresponding to the head packet, anddiscard the elements included in the other element regions. For example,while discarding from the storage unit 6 a packet not including amessage to be acquired, it is possible to leave a packet including themessage in the storage unit 6. Since the data including the message isstored in the element region corresponding to the head packet, it ispossible to extract a message using the element region left in the listregion 7.

Since the data is coupled by copying the data included in the newelement to the data in the other elements, it is possible to extract themessage from the list region 7 when the fragment length matches the sizeof the coupled data. A process of coupling the data by assuming that allpackets are head packets is performed, whereby it is possible to acquirethe message even when the packet received first is not the head packet.

Even when the capture device 2 mixedly receives packets of a pluralityof sessions, it is possible to store the packets in the list region 7for each session to perform data coupling processing, head packetdetection processing and message extraction processing. Even whenpackets of a plurality of sessions are mixedly received, it is possibleto discard, for each session, the element corresponding to the packetthat is not the head packet to leave the element including the messagein the list region 7.

FIG. 3 illustrates another embodiment of an information processingdevice, an information processing method, and a program. Elements whichare the same as or similar to those in FIG. 1 are denoted by the samereference numerals, and a detailed description thereof will be omitted.An information processing system 100A illustrated in FIG. 3 includes acapture node 20 connected to a tap 16 provided in a packet transmissionpath, a storage device 50 connected to the capture node 20, and ananalysis node 30 connected to the capture node 20. The capture node 20is an example of a capture device, and the analysis node 30 is anexample of an information processing device. The analysis node 30 mayacquire the packet stored in the storage device 50 without through thecapture node 20. The analysis node 30 may be included in the capturenode 20. For example, the capture node 20 and the analysis node 30 maybe incorporated in one server.

Terminal devices 10 (10 a, 10 b, 10 c) and server nodes 14 (14 a, 14 b)are mutually connected via the network NW, the tap 16 and the networkswitch 12. The network NW is connected to a port 12 a of the networkswitch 12 via the tap 16, and each of the server nodes 14 a and 14 b isconnected to one of ports 12 b and 12 c of the network switch 12. Theterminal device 10 and the server node 14 are examples of communicationdevices. For example, the terminal device 10 is a computer used by auser using the server node 14. The network switch 12 switches the pathof packets transmitted and received between the terminal device 10 andthe server node 14.

For example, in FIG. 3, a network file system (NFS) is constructed bythe terminal device 10 and the server node 14. In this case, theterminal device 10 functions as an NFS client and the server node 14functions as an NFS server. For example, the terminal device 10 and theserver node 14 transmit and receive messages by a remote procedure call(RPC) using a TCP/IP. In the following description, a messagetransmitted and received by RPC is also referred to as a RPC command ora command RPC. In a case where the size of the RPC command is largerthan the size that may be accommodated in one packet, the RPC command isdivided into a plurality of parts, stored in each of a plurality ofpackets, and transmitted as a packet group.

The capture node 20 includes a capture control unit 22, a packet buffer24, and a packet retrieval unit 26. The capture control unit 22 capturespackets transmitted and received between the terminal device 10 and theserver node 14 via the tap 16, and sequentially stores the capturedpackets in the packet buffer 24. For example, in a case where apredetermined amount of packets is stored in the packet buffer 24, thecapture control unit 22 stores a predetermined amount of packets in thestorage device 50.

The packet retrieval unit 26 retrieves and acquires the packet to beacquired from the storage device 50 based on the packet acquisitionrequest REQ from the analysis node 30, and outputs the acquired packetto the analysis node 30 as a response RES corresponding to theacquisition request REQ. The tap 16 may be installed at a position otherthan the position illustrated in FIG. 3. Instead of capturing packetsvia tap 16, the capture node 20 may capture a packet via a mirror port(not illustrated) of the network switch 12.

The capture node 20 may capture information such as data transmitted andreceived between devices other than the terminal device 10 and theserver node 14. For example, a computation node may be arranged insteadof the server node 14. Alternatively, a server node may be arrangedinstead of the terminal device 10, and a storage node, a database node,or the like may be arranged instead of the server node 14. Theinformation processing system 100A may include the network switch 12 andthe server node 14.

The analysis node 30 includes a packet collection unit 32, a messageextraction unit 34, and a memory 40. The memory 40 includes a listregion 42 and a program region 44. The memory 40 includes, for example,a memory module including a plurality of synchronous dynamic randomaccess memories (SDRAM). The memory 40 may include a static randomaccess memory (SRAM), a nonvolatile memory such as a flash memory or amagnetoresistive random access memory (MRAM).

The packet collection unit 32 outputs an acquisition request REQincluding a packet acquisition condition to the capture node 20 based onan instruction from an operator such as an analyst operating theanalysis node 30. The packet collection unit 32 receives the packet tobe acquired included in the response RES from the capture node 20. Aswith the packet collection unit 4 illustrated in FIG. 1, the packetcollection unit 32 assumes each of the packets received from the capturenode 20 as a head packet, and performs a process of creating a list inthe list region 42 for each session. The session indicates communicationthat is transmitted and received between each pair of the terminaldevice 10 and the server node 14. An example of the operation of thepacket collection unit 32 is illustrated in FIGS. 7A and 7B to FIG. 9.

As with the message extraction unit 5 illustrated in FIG. 1, the messageextraction unit 34 finds the head packet from among the packets for eachsession stored in the list region 42 and acquires the message. Themessage extraction unit 34 discards from the list region 42 packetsother than the head packet. An example of the operation of the messageextraction unit 34 is illustrated in FIGS. 7A and 7B to FIG. 9.

A program that implements the functions of the packet collection unit 32and the message extraction unit 34 is stored in the program region 44 ofthe memory 40. The functions of the packet collection unit 32 and themessage extraction unit 34 may be implemented by hardware.

FIG. 4 illustrates an example of the structure of a packet captured bythe capture node 20 illustrated in FIG. 3. Each packet includes anEthernet frame header, an IP header, a TCP header, and a TCP datapayload. The IP header, the TCP header, and the TCP data payload are theEthernet frame data payload. The Ethernet frame header includes adestination media access control (MAC) address and a transmission sourceMAC address. The IP header includes an IP packet length indicating thesize of the Ethernet frame data payload, a transmission source IPaddress of the packet, and a destination IP address of the packet.

The TCP header includes the port number of the transmission source ofthe packet and the port number of the destination of the packet. In acase where the TCP data payload contains the head data of the RPCcommand (for example, message), the TCP data payload includes a recordmarking standard (RM) and an RPC header. The structure of the RM and theRPC header is illustrated in FIG. 5.

FIG. 5 illustrates an example of the structure of the RM and the RPCheader illustrated in FIG. 4. The RM (4 bytes) contains the fragmentlength indicating the size (data length) of the RPC command before beingdivided and stored into a packet. The fragment length includes the sizeof the RPC header. The RPC header has different specifications between atime of CALL (calling) and a time of REPLY (response).

The RPC header at the time of CALL includes a region where a transactionidentifier xid, a message type mtype, and an RPC version number rpcversare stored (4 bytes each). The transaction identifier xid is set to anany value. The message type mtype=“0” represents CALL, and the messagetype mtype=“1” represents REPLY. The RPC version number rpcvers isnormally set to “2”. Any value except “2” is an abnormal value.

The RPC header at the time of CALL includes a region where any programnumber prog, any version number vers, and any procedure number proc areset (4 bytes each). The RPC header at the time of CALL includes a regionwhere the authentication information flavor and the authenticationinformation opaque of the client side (cred), and the authenticationinformation flavor and authentication information opaque of the serverside (verf) are set. The authentication information flavor has a size of4 bytes, and set to any value. The authentication information opaqueincludes 4 bytes of the data length and up to 400 bytes of data.

The RPC header at the response time (REPLY) includes a region where thetransaction identifier xid and the message type mtype are set, and aregion where the authentication information flavor and theauthentication information opaque of the server side (verf) are set. TheRPC header at the time of reply (REPLY) has a region where theacceptance status stat is set (4 bytes). The acceptance status stat isset to any one of integers of “0” to “5”. Any values other than theabove mentioned integer are abnormal values.

FIG. 6 illustrates an example of a plurality of packets transmittedthrough the network switch 12 illustrated in FIG. 3, and an example in acase where the capture node 20 illustrated in FIG. 3 captures thepackets with the head packet lost. In FIG. 6, in order to make thedescription easy to understand, the capture node 20 captures the packetsPCKT corresponding to one session.

For example, packets PCKT1, PCKT2, PCKT3, PCKT4, PCKT5, and PCKT6 aretransmitted from a terminal device 10 a to a server node 14 a. Thecommand RPC1 (D1+D2+D3), which is an RPC command (message), istransmitted using the packets PCKT1 to PCKT3, and the command RPC2(D4+D5) is transmitted using the packets PCKT4 to PCKT5. The head packetPCKT1 including the head data of the command RPC1 and the head packetPCKT4 including the head data of the command RPC2 include an RM and anRPC header.

The server node 14 a extracts the RM and the RPC header from the packetPCKT1, assembles the data D1, D2, and D3 included in the packets PCKT1to PCKT3, and acquires the command RPC1. The server node 14 a extractsthe RM and the RPC header from the packet PCKT4, assembles the data D4and D5 included in the packets PCKT4 to PCKT5, and acquires the commandRPC2.

On the other hand, in the example illustrated in FIG. 6, the capturenode 20 does not capture the head packet PCKT1, but captures packetsPCKT2 to PCKT6 sequentially. For example, an analysis node differentfrom the analysis node 30 assumes that the packet PCKT2 first capturedby the capture node 20 is the head packet, and starts a process ofacquiring the command RPC.

The different analysis node refers to the false RM from the head of thedata D2 in the packet PCKT2, and acquires the fragment length which isthe size of the RPC command. For example, since the fragment length isset using 31 bits of the RM, the maximum size that may be specified is 2gigabytes. In a case where the different analysis node acquires afragment length indicating 2 gigabytes, the other analysis nodes acquire2 gigabytes of data from a plurality of packets succeeding the packetPCKT2, and couples 2 gigabytes of data to create a fake command RPC1#.

Thereafter, the different analysis node analyzes the fake command RPC1#,but the analysis fails, and the other analysis nodes discard theacquired 2 gigabyte of data. For example, in a case where the capturenode 20 does not acquire the head packet PCKT1 including the RPCcommand, the different analysis node will acquire a large amount ofwasted data that may not be analyzed.

Since the different analysis node acquires the data D5 and D6 in packetsPCKT4 and PCKT6 as data located in the midstream of the fake commandRPC1#, it does not detect the correct RM and the correct RPC headerincluded in the packets PCKT4 and PCKT6. Therefore, in a case where thecapture node 20 does not acquire the head packet PCKT1 including the RPCcommand, the different analysis node not only fails to acquire the firstcommand RPC1, but also fails to acquire the other commands RPC followingthe command RPC1. The analysis node 30 illustrated in FIG. 3 solves theabove-mentioned problem.

FIGS. 7A and 7B, and FIGS. 8A and 8B illustrate an example of theoperation of the analysis node 30 illustrated in FIG. 3. FIGS. 7A and7B, and FIGS. 8A and 8B, as illustrated in FIG. 6, illustrate theoperation of the analysis node 30 when the capture node 20 does notcapture the head packet PCKT1, and sequentially captures the packetsPCKT2 to PCKT5. FIGS. 7A and 7B, and FIGS. 8A and 8B indicateinformation stored in the list region 42.

First, in FIG. 7A, the packet collection unit 32 of the analysis node 30identifies a session SSN1 based on the combination of the transmissionsource IP address and the destination IP address included in the IPheader of the first packet PCKT2. Thereafter, the packet collection unit32 identifies the session SSN1 for each of the packets PCKT3 to PCKT5 tobe received. The packet collection unit 32 refers to the source IPaddress SrcIP, and the destination IP address DistIP stored in advancein the session table SSNTBL to find the session table SSNTBLcorresponding to the session SSN1. The source IP address SrcIP indicatesthe transmission source of the packet, and the destination IP addressDistIP indicates the destination of the packet.

The packet collection unit 32 stores an element included in the firstpacket PCKT2 in the element region ELM2 allocated to the regioncorresponding to the session SSN1 in the list region 42. In a case wherethere is no session table SSNTBL corresponding to the combination of thetransmission source IP address and the destination IP address includedin the IP header of the packet PCKT2, a new session table SSNTBL iscreated. For example, the packet collection unit 32 allocates to thelist region 42 a new region for creating the list LIST in accordancewith the session SSN1 to create in the allocated region a session tableSSNTBL corresponding to the session SSN1. The packet collection unit 32stores the elements included in the packet PCKT2 in the element regionELM2 allocated to the new region.

The element of the packet PCKT2 stored in the element region ELM2includes the fragment length FL2 and the data D2 ((a) and (b) in FIG.7A). Since the packet PCKT2 is not the head packet, the head 4 bytes ofthe TCP data payload does not indicate a correct RM but indicates thefalse fragment length FL2. The data D2 is data of the entire TCP datapayload illustrated in FIG. 4, and the size of the data D2 is indicatedas a correct value according to the packet length included in the IPheader of the packet PCKT2.

The packet collection unit 32 stores a pointer PE2 indicating theelement region ELM2 in the session table SSNTBL corresponding to sessionSSN1 ((c) in FIG. 7A). The packet collection unit 32 stores a pointerPSTBL indicating the session table SSNTBL, and a pointer DP2 indicatingthe head of the region for storing the data D2 in the element regionELM2 ((d) and (e) in FIG. 7A).

The packet collection unit 32 determines the session SSN to which thepacket PCKT belongs by comparing the IP address included in the receivedpacket PCKT with the IP address included in the session table SSNTBL.The packet collection unit 32 stores a packet length included in the IPheader of the packet PCKT2 (For example, the size of the TCP datapayload) in the element region ELM2 as the current fragment length CFL21((f) in FIG. 7A). The current fragment length CFL21 includes the size ofthe RM and the size of the RPC header illustrated in FIG. 5.

Since the fragment length FL2 and the current fragment length CFL21 donot match, the message extraction unit 34 does not perform the operationof extracting the message. In a case where the fragment length FL2 andthe current fragment length CFL21 match, the message extraction unit 34performs a process of extracting the message using the data D2. Anexample of a process for extracting the message is described in FIG. 8B.

Next, in FIG. 7B, the packet collection unit 32 stores an elementincluded in the packet PCKT3 in the element region ELM3 added to thelist LIST. The element of the packet PCKT3 stored in the element regionELM3 includes the false fragment length FL3 and the data D3 (TCP datapayload) ((g) and (h) in FIG. 7B).

The packet collection unit 32 stores a pointer PE3 indicating theelement region ELM3 in the element region ELM2, and stores the pointerPE2 indicating the element region ELM2 in the element region ELM3 ((i)and (j) in FIG. 7B). The packet collection unit 32 stores a pointer DP3indicating the head of the region for storing the data D3 in the elementregion ELM3, and stores the current fragment length CFL31 indicating thesize of the data D3 included in the packet PCKT3 in the element regionELM3 ((k) and (l) in FIG. 7B).

The packet collection unit 32 copies the data D3 included in the packetPCKT3 to the element region ELM2, thereby coupling the data D3 to thedata D2 stored in the element region ELM2 ((m) in FIG. 7B). The positionat which the data D3 is copied to the element region ELM2 is calculatedby adding the current fragment length CFL22 to the value of the pointerDP2. The packet collection unit 32 updates the current fragment lengthCFL21 to the current fragment length CFL22 indicating the size of thedata D2 and D3 ((n) in FIG. 7B). The data D3 stored in the elementregion ELM3 may be used as a copy of the data D3, or the data D3 beforebeing stored in the element region ELM3 included in the packet PCKT3 maybe used.

Since the fragment length FL2 and the current fragment length CFL22 donot match, and the fragment length FL3 and the current fragment lengthCFL31 do not match, the message extraction unit 34 does not perform theoperation of extracting the message. As illustrated in FIGS. 7A and 7B,the list LIST for the session SSN1 is created by sequentially adding theelements corresponding to the packets PCKT2 and PCKT3 to the list region42.

Next, in FIG. 8A, as with FIG. 7B, the packet collection unit 32 storesin the element region ELM4 the element (FL4, D4), and the pointers PE3and DP4 included in the packet PCKT4, and stores a pointer PE4 in theelement region ELM3 ((a) to (e) in FIG. 8A). The packet collection unit32 couples the data D4 to the data D2 and D3 in the element region ELM2,and couples the data D4 to the data D3 in the element region ELM3 ((f)in FIG. 8A). The packet collection unit 32 stores the updated currentfragment lengths CFL23 and CFL32 in the list region 42 ((g) and (h) inFIG. 8A). Since the fragment length FL2 and the current fragment lengthCFL23 do not match, and the fragment length FL3 and the current fragmentlength CFL32 do not match, the message extraction unit 34 does notperform the operation of extracting the message.

Next, in FIG. 8B, as with FIGS. 7B and 8A, the packet collection unit 32performs a process of storing information in the element region ELM5based on the packet PCKT5 ((i) in FIG. 8B). The packet collection unit32 performs a process of coupling the data D5 included in the packetPCKT5 to each of the data in the element regions ELM2, ELM3, and ELM4((j) in FIG. 8B). The packet collection unit 32 updates the currentfragment lengths CFL23, CFL32, and CFL41 to the current fragment lengthsCFL24, CFL33, and CFL42 respectively in each of the element regionsELM2, ELM3, and ELM4 ((l) and (m) in FIG. 8B).

The message extraction unit 34 detects that the fragment length FL2 andthe current fragment length CFL24 do not match, and detects that thefragment length FL3 and the current fragment length CFL33 do not match.On the other hand, the packet PCKT4 is a true head packet, and the RPCcommand is included in the data D4 and D5 included in the packets PCKT4and PCKT5. Thus, the message extraction unit 34 detects that thefragment length FL4 and the current fragment length CFL42 match ((n) inFIG. 8).

The message extraction unit 34 discards the first 4 bytes correspondingto the RM from the data D4 (TCP data payload of the packet PCKT4),thereby extracting the RPC command, which is a message including the RPCheader ((o) in FIG. 8B). Thereafter, the message extraction unit 34discards the elements stored in the other element regions ELM2, ELM3,and ELM5 in which the fragment length FL and the current fragment lengthCFL do not match ((p), (q) and (r) in FIG. 8B). The message extractionunit 34 discards the element region ELM4, for example, in a case wherethe analysis processing of the RPC command extracted from the elementregion ELM4 and other processing are completed.

In this way, in a case where element regions ELM corresponding to eachof the packets are sequentially added to the list LIST, connecting theelement regions ELM with a pointer makes it possible to make theconnection relation between the element regions ELM correspond in orderof the reception of the packets. By indicating the region where data isstored by pointers DP2 and DP3, and so forth, it is possible toallocate, in the element regions ELM, a region for storing the elementsincluded in the packet and a region for storing the data to differentplaces in the list region 42.

In a case where the size of each element region ELM is set consideringthat data is coupled up to the maximum fragment length, it is possibleto arrange parameter regions other than the region for storing data ineach element region ELM at a position close to each other in the addressspace. As a result, for example, it is possible to improve the accessefficiency of the list region 42 in a case of updating the currentfragment length CFL of the plurality of element regions ELM or othercase, compared with the case where the parameter regions are notarranged close to each other.

FIG. 9 illustrates an example of an operation flow of the analysis node30 illustrated in FIG. 3. For example, FIG. 9 illustrates an example ofan information processing method by the information processing deviceand a program performed by the information processing device.

The analysis node 30 starts the operation flow illustrated in FIG. 9 foreach session SSN based on the reception of the packet to be analyzedfrom the capture node 20. Therefore, the packet collection unit 32 ofthe analysis node 30 refers to the IP header of the received packet, anddetermines the session SSN to which each packet belongs. For example,the analysis node 30 stores the packet received from the capture node 20in a predetermined buffer region of the memory 40, and performs theoperation flow illustrated in FIG. 9 by using the packet stored in thepredetermined buffer region.

First, in step S100, in a case where there is a packet to be acquiredfrom which an RPC command is acquired wherein the packet is a packet inwhich an element has not been added to the list LIST illustrated inFIGS. 7A and 8B, or FIGS. 8A and 7B, the packet collection unit 32transfers the process to step S102. In a case where there is no packetto be acquired from which the RPC command is acquired, the packetcollection unit 32 transfers the process to step S116.

In step S102, the packet collection unit 32 selects the packet with theearliest reception time from among the packets in which the element hasnot been added to the list LIST, and acquires elements such as afragment length, data and so forth included in the selected packet.Next, in step S104, the packet collection unit 32 stores the elementsuch as the acquired fragment length and data in the element region ELMof the list LIST corresponding to the session SSN to which the packetbelongs. For example, the packet collection unit 32 adds the elementincluded in the packet to the list LIST.

Next, in step S106, the packet collection unit 32 determines whether theother element regions ELM in which the elements are stored are presentin the list LIST. In a case where the other element regions ELM in whichthe elements are stored are present in the list LIST, the processproceeds to step S108, and in a case where no other element regions ELMin which elements are stored are present in the list LIST, the processproceeds to step S118.

In step S108, the packet collection unit 32 couples the data included inthe newly acquired element in step S104 to the data included in theother element regions ELM. In step 5110, the message extraction unit 34compares the fragment length FL with the current fragment length CFL ineach element region ELM in the list LIST. Next, in step S112, in a casewhere there is an element region ELM in which the fragment length FL andthe current fragment length CFL match, the message extraction unit 34determines that the RPC command has been detected, and transfers theprocess to step S114. On the other hand, in a case where there is noelement region ELM in which the fragment length FL and the currentfragment length CFL match, the message extraction unit 34 determinesthat the RPC command has not been detected, and returns the process tostep S100.

In step S114, the message extraction unit 34 removes the RM from thedata included in the element region ELM in which the fragment length FLand the current fragment length CFL match, and extracts the RPC commandincluding the RPC header. The message extraction unit 34 discards theelement stored in the other element regions ELM in which the fragmentlength FL and the current fragment length CFL do not match. The messageextraction unit 34 returns the process to step S100 in order to extractthe next RPC command.

In step S116, since there is no packet to be acquired from which the RPCcommand is acquired, the message extraction unit 34 discards theelements included in the element region ELM remaining in the list LIST,to thereby clear the list LIST is cleared, and terminates the process.For example, the message extraction unit 34 discards an element includedin the element region ELM from which the RPC command is extracted, andwhich is left without being discarded.

As described above, in the embodiments illustrated in FIGS. 3 to 9, aswith the embodiment illustrated in FIGS. 1 and 2, in a case where thehead packet is unknown, it is possible to leave only the element regioncorresponding to the head packet for each session SSN, and discard theelements included in the other element regions ELM. Since the dataincluding the message is stored in the element region corresponding tothe head packet, it is possible to use the element region left in thelist region 42, and extract the messages for each session SSN. When thefragment length matches the size of the coupled data, it is possible toextract the message from the list region 7. A process of coupling thedata by assuming that all packets are head packets is performed, wherebyit is possible to acquire the message even when the packet receivedfirst is not the head packet.

In the embodiment illustrated in FIGS. 3 to 9, connecting the elementregions ELM with a pointer makes it possible to make the connectionrelation between the element regions ELM correspond in order of thereception of the packets. The parameter regions of the element regionELM are arranged at positions close to each other. As a result, it ispossible to improve the access efficiency of the list region 42 in acase of updating the current fragment length CFL of the plurality ofelement regions ELM or other case, compared with the case where theparameter regions are not arranged close to each other.

FIG. 10 illustrates another embodiment of an information processingdevice, an information processing method, and a program. Elements thatare the same as or similar to those described in the embodimentillustrated in FIG. 3 are denoted by the same reference numerals, and adetailed description thereof will be omitted. As with the informationprocessing system 100A in FIG. 3, an information processing system 100Billustrated in FIG. 10 includes the capture node 20 connected to the tap16, the storage device 50 connected to the capture node 20, and theanalysis node 30 connected to the capture node 20.

The analysis node 30 includes a packet collection unit 32B instead ofthe packet collection unit 32 illustrated in FIG. 3. The analysis node30 includes a head determination unit 36B. Other configurations of theanalysis node 30 are the same as those in FIG. 3.

The head determination unit 36B determines based on the element includedin the packet whether there is a possibility that the packet is a headpacket. In a case where the head determination unit 36B determines thatthere is a possibility that the packet is the head packet, the packetcollection unit 32B performs a process of storing the element of thepacket in the list region. On the other hand, in a case where the headdetermination unit 36B determines that there is no possibility of apacket as the head packet, the packet collection unit 32B does notperform the process of storing the elements of the packet in the listregion. An example of the operation of the analysis node 30 illustratedin FIG. 10 is illustrated in FIGS. 11A and 11B to FIG. 14.

FIGS. 11A and 11B, and FIGS. 12A and 12B illustrate an example of theoperation of the analysis node 30 illustrated in FIG. 10. Detaileddescription of the same or similar operations as those in FIGS. 7A and7B, and FIGS. 8A and 8B will be omitted. As with FIGS. 7A and 7B, andFIGS. 8A and 8B, FIGS. 11A and 11B, and FIGS. 12A and 12B illustrate theoperation of the analysis node 30 when the capture node 20 does notcapture the head packet PCKT1, and sequentially captures the packetsPCKT2 to PCKT5.

In FIG. 11A, the head determination unit 36B performs a process ofdetermining whether there is a possibility that the packet PCKT2 is ahead packet, and determines that there is no possibility that the packetPCKT2 is a head packet. In a case where the head determination unit 36Bdetermines that there is no possibility that the packet PCKT2 is a headpacket, the packet collection unit 32B does not perform a process ofstoring the elements included in the packet PCKT2 in the element regionELM2 ((a) in FIG. 11A). In FIG. 11A, the rectangular frame indicated bythe broken line illustrated in the list LIST indicates that the elementsincluded in the packet PCKT2 is not stored in the element region ELM2.

Next, in FIG. 11B, the head determination unit 36B determines that thereis no possibility of the packet PCKT3 is a head packet. As a result, aswith FIG. 11A, the packet collection unit 32B does not perform a processof storing the elements included in the packet PCKT3 in the elementregion ELM3 ((b) in FIG. 11B).

Next, in FIG. 12A, the head determination unit 36B determines that thereis a possibility that the packet PCKT4 is a head packet. In a case wherethe head determination unit 36B determines that there is a possibilitythat the packet PCKT4 is a head packet, the packet collection unit 32Bperforms a process of storing the elements included in the packet PCKT4in the element region ELM4 ((a) in FIG. 12A). The packet collection unit32B stores the pointer PSTBL indicating the session table SSNTBL in theelement region ELM4, and stores the pointer PE4 indicating the elementregion ELM4 in the session table SSNTBL ((b) and (c) in FIG. 12A). Thepacket collection unit 32B stores a pointer DP4 indicating the head ofthe region storing the data D4 in the element region ELM2 ((d) in FIGS.12A and 12B).

In FIG. 12B, the head determination unit 36B determines that there is nopossibility of the packet PCKT5 is a head packet. However, the elementregion ELM4 corresponding to the other packets PCKT4 different from thepacket PCKT5 has been already stored in the list LIST. In this case, aswith FIG. 8B, the packet collection unit 32B performs a process ofstoring the elements included in the packet PCKT5 in the element regionELM5 ((e) in FIG. 12B). The packet collection unit 32B performs aprocess of coupling the data D5 included in the packet PCKT5 to the dataD4 in the element region ELM4 ((f) in FIG. 12B).

After this, as with FIG. 8B, the message extraction unit 34 detects thatthe fragment length FL4 and the current fragment length CFL42 match, andextracts an RPC command, which is a message including an RPC header ((g)and (h) in FIG. 12B). A message extraction unit 34B discards the elementregion ELM5 in which the fragment length FL and the current fragmentlength CFL do not match ((i) in FIG. 12B). For example, in a case wherethe analysis processing of the RPC command extracted from the elementregion ELM4 and other processing are completed, the message extractionunit 34 discards the element region ELM4.

As illustrated in FIGS. 11A and 11B, and FIGS. 12A and 12B, the analysisnode 30 does not perform a process of storing the elements included inthe packet having no possibility of being a head packet in the listLIST. As a result, it is possible to avoid unnecessary elements frombeing held in the list region 42. It is possible to reduce the size ofthe list region 42, compared with the case where the elements of all thereceived packet PCKT are stored in the list region 42. This makes itpossible to effectively use the storage region of the memory 40.

FIG. 13 illustrates an example of an operation flow of the analysis node30 illustrated in FIG. 10. For example, FIG. 13 illustrates an exampleof an information processing method by the information processing deviceand a program performed by the information processing device. Processeswhich are the same as or similar to that in FIG. 9 are denoted by thesame reference numerals, and a detailed description thereof will beomitted. In FIG. 13, steps S200, S103, S120, and S122 are added withrespect to FIG. 9. Steps S200 and S103 are inserted between step S102and step S104 in FIG. 9.

In step S102, after acquiring an element such as fragment length anddata from the packet, in step S200, the head determination unit 36Bdetermines whether there is a possibility that the packet from which theelement has been acquired is a head packet. An example of the operationof step S200 is illustrated in FIG. 14.

Next, in step S103, in a case where there is a possibility that thepacket is a head packet, the process proceeds to step S104, and in acase where there is no possibility that the packet is a head packet, theprocess proceeds to step S120. In and after step S104, as in FIG. 9,processing of adding an element included in the packet to the elementregion ELM, and coupling the data, and so forth is performed. Theprocessing in and after step S104 is performed only on the packet havingthe possibility of being a head packet.

In step S120, in a case where the other element regions ELM in whichelements are stored are present in the list LIST, the process proceedsto step S122, and in a case where no other element regions ELM arepresent in the list LIST, the process returns to step S100. In stepS122, the packet collection unit 32B adds the fragment length and dataelements acquired from the packet to the list LIST, transfers theprocess to step S108, and performs a process of coupling the data.

FIG. 14 illustrates an example of the operation flow of step S200illustrated in FIG. 13. First, in step S202, the head determination unit36B refers to the TCP data payload included in the packet, and acquiresthe information stored in the region of the RPC header included in theTCP data payload in a case where the packet is a head packet.

Next, in step S204, the head determination unit 36B refers to the regionregarded as the message type mtype of the RPC header. Next, in stepS206, in a case where the message type mtype is “0”, the headdetermination unit 36B determines that the region is an RPC header atthe time of CALL (calling), and transfers the process to step S208. In acase where the message type mtype is “1”, the head determination unit36B determines that the region is an RPC header at the time of REPLY(response), and transfers the process to step S222. In a case where themessage type mtype is neither “0” nor “1”, the head determination unit36B determines that the region is not an RPC header, and transfers theprocess to step S234.

In step S208, the head determination unit 36B refers to the region thatis regarded as the RPC version number rpcvers. Next, in step S210, thehead determination unit 36B transfers the process to step S212 in a casewhere the RPC version number rpcvers is “2” and transfers the process tostep S234 in a case where the RPC version number rpcvers is other than“2”.

In step S212, the head determination unit 36B refers to a regionregarded as authentication information opaque on the client side (cred).Next, in step S214, the head determination unit 36B transfers theprocess to step S216 in a case where the authentication informationopaque is 400 bytes or less, and transfers the process to step S234 in acase where the authentication information opaque exceeds 400 bytes.

In step S216, the head determination unit 36B refers to a regionregarded as authentication information opaque on the server side (verf).Next, in step S218, the head determination unit 36B transfers theprocess to step S230 in a case where the authentication informationopaque is 400 bytes or less, and transfers the process to step S234 in acase where the authentication information opaque exceeds 400 bytes. Instep S230, the head determination unit 36B determines that there is apossibility that the received packet is a head packet, and terminatesthe process.

On the other hand, in step S222, the head determination unit 36B refersto a region regarded as authentication information opaque on the serverside (verf). Next, in step S224, the head determination unit 36Btransfers the process to step S226 in a case where the authenticationinformation opaque is 400 bytes or less, and transfers the process tostep S234 in a case where the authentication information opaque exceeds400 bytes.

In step S226, the head determination unit 36B refers to a regionregarded as the acceptance status stat. Next, in step S228, the headdetermination unit 36B transfers the process to step S232 in a casewhere the acceptance status stat is any one of “0” to “5”, and transfersthe process to step S234 in a case where the acceptance status stat isneither “0” nor “5”. In step S232, the head determination unit 36Bdetermines that there is a possibility that the received packet is ahead packet, and terminates the process. On the other hand, in stepS234, the head determination unit 36B determines that there is nopossibility of the received packet is a head packet, and terminates theprocess.

As described above, by using the information of the RPC header in whichthe predetermined value is set, it is possible to determine whetherthere is a possibility that the packet is a head packet. Use of aplurality of parameters of the RPC header makes it possible to improvethe accuracy of the determination result of the possibility of the headpacket, compared with the case where the determination is performed byusing a single parameter. In spite of the fact that it is determinedthat there is a possibility that the packet is a head packet, it may notactually be the head packet. The reason may be that the packet is notthe head packet because correct analysis may not be performed since theextracted RPC command is incorrect.

As described above, as in the embodiment illustrated in FIGS. 1 to 9, inthe embodiments illustrated in FIGS. 10 to 14, in a case where the headpacket is unknown, it is possible to leave only the element regioncorresponding to the head packet for each session SSN, and discard theelements included in the other element regions. Since the data includingthe message is stored in the element region corresponding to the headpacket, it is possible to use the element region left in the list region42, and extract the messages for each session SSN. When the fragmentlength matches the size of the coupled data, it is possible to extractthe message from the list region 7. A process of coupling the data byassuming that all packets are head packets is performed, whereby it ispossible to acquire the message even when the packet received first isnot the head packet.

In the embodiment illustrated in FIG. 10 to FIG. 14, the packetcollection unit 32B does not perform a process of storing the elementsincluded in the packet having no possibility of being a head packet inthe list LIST. As a result, it is possible to avoid unnecessary elementsfrom being held in the list region 42. It is possible to reduce the sizeof the list region 42, compared with the case where the elements of allthe received packets PCKT are stored in the list region 42 and data arecoupled. This makes it possible to effectively use the storage region ofthe memory 40.

By using the information of the RPC header in which the value in thepredetermined range is stored, it is possible to determine whether thereis a possibility that the packet is a head packet. Use of a plurality ofparameters of the RPC header makes it possible to improve the accuracyof the determination result of the possibility of the head packet,compared with the case where the determination is performed by using asingle parameter.

FIG. 15 is a diagram illustrating an example of a hardware configurationof the information processing device 3 illustrated in FIG. 1 and theanalysis node 30 illustrated in FIGS. 3 and 10. Since the informationprocessing device 3 and the analysis node 30 have the sameconfiguration, hereinafter, the configuration of the analysis node 30will be described.

The analysis node 30 includes a mother board 200, an optical drivedevice 300, a hard disk device 320, an input device 340, an outputdevice 360, and so forth. The mother board 200 includes variouscomponents such as a processor 210, a main storage device 220, anoptical drive controller 230, a hard disk controller 240, an inputinterface 250, an output interface 260, and a network interface 270. Forexample, the processor 210 may be a central processing unit (CPU), agraphics processing unit (GPU) or the like.

The processor 210, the main storage device 220, the optical drivecontroller 230, the hard disk controller 240, the input interface 250,the output interface 260, and the network interface 270 are connected toa system bus SBUS. The main storage device 220 corresponds to thestorage unit 6 illustrated in FIG. 1 and the memory 40 illustrated inFIG. 3 and so forth. The processor 210, the optical drive controller230, the hard disk controller 240, the input interface 250, the outputinterface 260, and the network interface 270 may be included in a commonsemiconductor chip. The processor 210 executes the program (the programstored in the program region 44 in FIGS. 3 and 10) stored in the mainstorage device 220, thereby implementing the function of the analysisnode 30.

The optical drive controller 230 is connected to the optical drivedevice 300, and may access a recording medium 380 installed in theoptical drive device 300. The recording medium 380 is a compact disc(CD: registered trademark), a digital versatile disc (DVD: registeredtrademark), and for example, stores a program executed by the processor210. Programs and so forth executed by the processor 210 are downloadedfrom the recording medium 380 to the hard disk device 320 via theoptical drive device 300, and transferred to the main storage device220. The processor 210 may download the program from the recordingmedium 380 to the main storage device 220 without through the hard diskdevice 320.

The hard disk controller 240 is connected to the hard disk device 320.For example, when the analysis node 30 is turned on, the processor 210transfers the program stored in the hard disk device 320 to the mainstorage device 220, and operates by executing the program transferred tothe main storage device 220.

The input interface 250 is connected to the input device 340 such as akeyboard and a mouse. The output interface 260 is connected to theoutput device 360 such as a display and a printer. The network interface270 is connected to the capture node 20 and so forth illustrated inFIGS. 3 and 10.

Feature points and advantages of the embodiments will be clarified bythe above detained explanation. This intends to extend the scope ofclaims to the feature points and the advantages of the embodimentswithout departing from the spirit of claims. Those having ordinaryknowledge in the technical field may be able to easily conceive allimprovements and modifications. Therefore, the scope of the embodimentshaving inventiveness is not intended to be limited to the scopeexplained above and may depend on appropriate improvements andequivalents included in the scope disclosed in the embodiments.

All examples and conditional language provided herein are intended forthe pedagogical purposes of aiding the reader in understanding theinvention and the concepts contributed by the inventor to further theart, and are not to be construed as limitations to such specificallyrecited examples and conditions, nor does the organization of suchexamples in the specification relate to a showing of the superiority andinferiority of the invention. Although one or more embodiments of thepresent invention have been described in detail, it should be understoodthat the various changes, substitutions, and alterations could be madehereto without departing from the spirit and scope of the invention.

What is claimed is:
 1. An information processing device comprising: amemory; and a processor coupled to the memory and the processorconfigured to execute a process, the process including: when a firstpacket transmitted from a communication device to another communicationdevice via a network is captured, extracting, from the first packet,first element data corresponding to a session used for communication ofthe first packet; storing, in a storage device, the extracted firstelement data in association with the first packet and the session; whensecond element data associated with a second packet and the session isstored in the storage unit, coupling the extracted first element data tothe second element data; obtaining, for each of the first packet and thesecond packet, a data value from a predetermined position in a packet,the predetermined position being a position at which a fragment lengthis stored in a case where the packet is a head packet; and when a datasize of a specific element data that is one of the first element dataand the second element data, for which the coupling has been executed,matches the obtained data value corresponding to the packet associatedwith the specific element data, discarding element data, associated withthe session, other than the specific element data from the storagedevice.
 2. The information processing device according to claim 1,wherein the process further includes: determining the specific elementdata, matching the obtained data value, to be a message; and discardingthe specific element data from the storage device after the message isretrieved.
 3. The information processing device according to claim 1,wherein the process further includes: determining, for each of the firstpacket and the second packet, whether there is a possibility that thepacket is the head packet; preventing element data corresponding to thepacket determined not to be the head packet from being stored in thestorage device.
 4. The information processing device according to claim3, wherein a data payload of the head packet including a fragment lengthincludes a header region that stores a plurality of parameters used fortransmitting and receiving a message; and wherein the determiningwhether there is the possibility includes: referring to the plurality ofparameters included in the header region with assumes that each packetis a head packet; and determining that a packet, corresponding to anelement in which at least one of the referred parameters is an abnormalvalue, has no possibility of being the head packet.
 5. The informationprocessing device according to claim 1, wherein the coupling includes:replicating the first element data; and coupling the replicated elementdata to the second element data.
 6. The information processing deviceaccording to claim 1, wherein each of a plurality of pieces of theelement data stored in the storage unit includes the fragment length, apacket pointer indicating an order relation of the plurality of piecesof the element data, a current fragment length indicating a size of theelement data, and a data pointer indicating a storage position of theelement data.
 7. An information processing method executed by acomputer, the information processing method comprising: when a firstpacket transmitted from a communication device to another communicationdevice via a network is captured, extracting, from the first packet,first element data corresponding to a session used for communication ofthe first packet; storing, in a storage device, the extracted firstelement data in association with the first packet and the session; whensecond element data associated with a second packet and the session isstored in the storage unit, coupling the extracted first element data tothe second element data; obtaining, for each of the first packet and thesecond packet, a data value from a predetermined position in a packet,the predetermined position being a position at which a fragment lengthis stored in a case where the packet is a head packet; and when a datasize of a specific element data that is one of the first element dataand the second element data, for which the coupling has been executed,matches the obtained data value corresponding to the packet associatedwith the specific element data, discarding element data, associated withthe session, other than the specific element data from the storagedevice.
 8. A non-transitory computer-readable storage medium storing aprogram that causes a computer to execute a process, the processcomprising: when a first packet transmitted from a communication deviceto another communication device via a network is captured, extracting,from the first packet, first element data corresponding to a sessionused for communication of the first packet; storing, in a storagedevice, the extracted first element data in association with the firstpacket and the session; when second element data associated with asecond packet and the session is stored in the storage unit, couplingthe extracted first element data to the second element data; obtaining,for each of the first packet and the second packet, a data value from apredetermined position in a packet, the predetermined position being aposition at which a fragment length is stored in a case where the packetis a head packet; and when a data size of a specific element data thatis one of the first element data and the second element data, for whichthe coupling has been executed, matches the obtained data valuecorresponding to the packet associated with the specific element data,discarding element data, associated with the session, other than thespecific element data from the storage device.